And I talk about scenario where you explicit let users know MITM is happening and where users must comply (for example, Kazakhstan wanted to have a national-wide MITM proxy, to protect their citizens from malicious foreign websites, even go as far to ask Mozilla to include their CA.)
But I just can't think of a scenario where you don't have to manage the connections between the MITM proxy and Remote server. And that feels very expensive to me to do on a national scale.
Thus my question:
Is it possible to MITM TLS without maintaining connection between proxy and remote server? When the client will comply with your order to install Root CA certificate.
Let's assume we need to handle HSTS as well, and users are using normal browsers.
(Of course, using backdoors on OS/Browser will be easier than hijacking TLS, but let's assume we have to go the hijack route.)